npm: set npm_config_build_from_source=true to handle prebuildify packages

hermeto/core/package_managers/javascript/npm/main.py

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-3.0-only
 from hermeto.core.models.input import Request
-from hermeto.core.models.output import ProjectFile, RequestOutput
+from hermeto.core.models.output import EnvironmentVariable, ProjectFile, RequestOutput
 from hermeto.core.models.property_semantics import PropertySet
 from hermeto.core.models.sbom import Component, create_backend_annotation
 from hermeto.core.package_managers.javascript.npm import project as npm_project
@@ -57,13 +57,20 @@ def fetch_npm_source(request: Request) -> RequestOutput:
         for projectfile in info["projectfiles"]:
             project_files.append(projectfile)
 
+    env_vars = [
+        EnvironmentVariable(
+            name="npm_config_build_from_source",
+            value="true",
+        ),
+    ]
+
     components = _generate_component_list(component_info)
     annotations = []
     if backend_annotation := create_backend_annotation(components, "npm"):
         annotations.append(backend_annotation)
     return RequestOutput.from_obj_list(
         components=components,
-        environment_variables=[],
+        environment_variables=env_vars,
         project_files=project_files,
         annotations=annotations,
     )

hermeto/core/package_managers/javascript/yarn/main.py

@@ -323,6 +323,7 @@ def _generate_environment_variables() -> list[EnvironmentVariable]:
         "YARN_ENABLE_IMMUTABLE_CACHE": "false",
         "YARN_ENABLE_MIRROR": "true",
         "YARN_GLOBAL_FOLDER": "${output_dir}/deps/yarn",
+        "npm_config_build_from_source": "true",
     }
 
     return [EnvironmentVariable(name=key, value=value) for key, value in env_vars.items()]

hermeto/core/package_managers/javascript/yarn_classic/main.py

@@ -189,6 +189,7 @@ def _generate_build_environment_variables() -> list[EnvironmentVariable]:
     env_vars = {
         "YARN_YARN_OFFLINE_MIRROR": "${output_dir}/deps/yarn-classic",
         "YARN_YARN_OFFLINE_MIRROR_PRUNING": "false",
+        "npm_config_build_from_source": "true",
     }
 
     return [EnvironmentVariable(name=key, value=value) for key, value in env_vars.items()]

tests/unit/package_managers/javascript/npm/test_main.py

@@ -1,11 +1,16 @@
 # SPDX-License-Identifier: GPL-3.0-only
 from pathlib import Path
+from unittest import mock
 
 import pytest
 
 from hermeto import APP_NAME
+from hermeto.core.models.output import EnvironmentVariable, RequestOutput
 from hermeto.core.models.sbom import Component, Property
-from hermeto.core.package_managers.javascript.npm.main import _generate_component_list
+from hermeto.core.package_managers.javascript.npm.main import (
+    _generate_component_list,
+    fetch_npm_source,
+)
 from hermeto.core.package_managers.javascript.npm.project import NpmComponentInfo
 
 
@@ -120,3 +125,46 @@
     """Test _generate_component_list with different NpmComponentInfo inputs."""
     merged_components = _generate_component_list(components)
     assert merged_components == expected_components
+
+
+@mock.patch(
+    "hermeto.core.package_managers.javascript.npm.main.create_backend_annotation",
+    return_value=None,
+)
+@mock.patch("hermeto.core.package_managers.javascript.npm.main._resolve_npm")
+def test_fetch_npm_source_sets_build_from_source_env_var(
+    mock_resolve_npm: mock.Mock,
+    mock_create_annotation: mock.Mock,
+    rooted_tmp_path: "RootedPath",
+) -> None:
+    """fetch_npm_source must set npm_config_build_from_source=true so that
+    prebuildify packages compile from source instead of using prebuilt binaries.
+    See https://github.com/hermetoproject/hermeto/issues/1015."""
+    from hermeto.core.models.input import Request
+    from hermeto.core.rooted_path import RootedPath
+
+    (rooted_tmp_path.path / ".").mkdir(exist_ok=True)
+    request = Request(
+        source_dir=rooted_tmp_path,
+        output_dir=rooted_tmp_path.join_within_root("output"),
+        packages=[{"type": "npm", "path": "."}],
+    )
+    mock_resolve_npm.return_value = {
+        "package": {
+            "name": "foo",
+            "version": "1.0.0",
+            "purl": "pkg:npm/foo@1.0.0",
+            "bundled": False,
+            "dev": False,
+            "missing_hash_in_file": None,
+            "external_refs": None,
+        },
+        "dependencies": [],
+        "projectfiles": [],
+    }
+
+    output = fetch_npm_source(request)
+
+    assert EnvironmentVariable(name="npm_config_build_from_source", value="true") in (
+        output.build_config.environment_variables
+    )

tests/unit/package_managers/javascript/yarn/test_main.py

@@ -37,6 +37,7 @@ def yarn_env_variables() -> list[EnvironmentVariable]:
         EnvironmentVariable(name="YARN_ENABLE_IMMUTABLE_CACHE", value="false"),
         EnvironmentVariable(name="YARN_ENABLE_MIRROR", value="true"),
         EnvironmentVariable(name="YARN_GLOBAL_FOLDER", value="${output_dir}/deps/yarn"),
+        EnvironmentVariable(name="npm_config_build_from_source", value="true"),
     ]
 
 

tests/unit/package_managers/javascript/yarn_classic/test_main.py

@@ -44,6 +44,7 @@ def yarn_classic_env_variables() -> list[EnvironmentVariable]:
             name="YARN_YARN_OFFLINE_MIRROR", value="${output_dir}/deps/yarn-classic"
         ),
         EnvironmentVariable(name="YARN_YARN_OFFLINE_MIRROR_PRUNING", value="false"),
+        EnvironmentVariable(name="npm_config_build_from_source", value="true"),
     ]